How do I secure my Vercel deployment?

Start by adding security headers through middleware or next.config.js, including Content-Security-Policy, Permissions-Policy, and Referrer-Policy. Enable Deployment Protection for preview deployments to prevent unauthorized access to staging environments. Audit your environment variables to ensure no secrets are prefixed with NEXT_PUBLIC_ and use server-side API routes to proxy sensitive API calls. Implement rate limiting on API routes and enable Vercel Firewall rules if available on your plan. UNPWNED assesses externally observable header, secret-exposure, endpoint, rate-limit, dependency, and error-disclosure signals. Paid reports add prioritized remediation guidance for completed findings.